ci: give prebuild jobs contents:write so release uploads work

The prebuild jobs run `prebuild -u $GITHUB_TOKEN`, which uploads the built
.node binaries to the GitHub release. That needs `contents: write`, but this
repo's default workflow token is read-only (default_workflow_permissions:
read), so the uploads would 403 and prebuild-install would find no binaries.

Add `permissions: contents: write` to each of the 7 prebuild jobs. No trigger
or flow change — releases are still cut via the `release` event (manual
`npm version` + publishing a GitHub Release).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: arv

.github/workflows/build.yml

@@ -145,6 +145,8 @@ jobs:
 
   prebuild:
     if: ${{ github.event_name == 'release' }}
+    permissions:
+      contents: write # prebuild -u uploads the .node assets to the GitHub release
     strategy:
       fail-fast: false
       matrix:
@@ -176,6 +178,8 @@ jobs:
 
   prebuild-linux-x64:
     if: ${{ github.event_name == 'release' }}
+    permissions:
+      contents: write # prebuild -u uploads the .node assets to the GitHub release
     name: Prebuild on Linux x64
     runs-on: ubuntu-latest
     container: node:20-bullseye
@@ -188,6 +192,8 @@ jobs:
 
   prebuild-linux-x64-node-modern:
     if: ${{ github.event_name == 'release' }}
+    permissions:
+      contents: write # prebuild -u uploads the .node assets to the GitHub release
     name: Prebuild on Linux x64 (Node 25+)
     runs-on: ubuntu-latest
     container: node:20-bookworm
@@ -200,6 +206,8 @@ jobs:
 
   prebuild-alpine:
     if: ${{ github.event_name == 'release' }}
+    permissions:
+      contents: write # prebuild -u uploads the .node assets to the GitHub release
     name: Prebuild on alpine
     runs-on: ubuntu-latest
     container: node:20-alpine
@@ -213,6 +221,8 @@ jobs:
 
   prebuild-alpine-arm:
     if: ${{ github.event_name == 'release' }}
+    permissions:
+      contents: write # prebuild -u uploads the .node assets to the GitHub release
     strategy:
       fail-fast: false
       matrix:
@@ -235,6 +245,8 @@ jobs:
 
   prebuild-linux-arm:
     if: ${{ github.event_name == 'release' }}
+    permissions:
+      contents: write # prebuild -u uploads the .node assets to the GitHub release
     strategy:
       fail-fast: false
       matrix:
@@ -256,6 +268,8 @@ jobs:
 
   prebuild-linux-arm-node-modern:
     if: ${{ github.event_name == 'release' }}
+    permissions:
+      contents: write # prebuild -u uploads the .node assets to the GitHub release
     strategy:
       fail-fast: false
       matrix: